feat(audit): hash-chain cutoff - chain only rows written from first enablement, no backlog (#139)

Owner decision on #107 (2026-11-13): enabling AuditLog:HashChain must not
chain the historical backlog. main chained every unchained row oldest-first.

- The first chaining pass on a pristine database (no head, no chained row)
  writes a chain-start anchor: AuditLogChainTombstone (cutoff month,
  ChainSeq 0), PurgedAtUtc = DB SYSUTCDATETIME(), RowHash =
  SHA-256("ScadaBridge.AuditLog.ChainCutoff.v1" || YYYY-MM || ticks).
  Written once under the exclusive chain lock, so both centrals agree
  whatever their clocks/config. No migration: existing table + grants.
- Only rows with OccurredAtUtc >= cutoff are chained. The anchor hash is
  the cutoff month's genesis, binding the cutoff into the chain.
- AuditLog:HashChain:ChainBacklog (default false) restores chain-everything,
  read only on the very first enablement. Legacy chains (heads, no anchor)
  keep chaining everything.
- verify-chain splits unchained rows into UnchainedRows vs PreCutoffRows
  (+ ChainFromUtc); new breaks ChainedBeforeCutoff (row re-dated before the
  cutoff, or cutoff moved forward) and CutoffAnchorInvalid (anchor hash /
  month / multiplicity). Archive verify uses the anchor from its own
  tombstone file or the DB.
- Partition switch-out keeps the anchor (deletes ChainSeq > 0 only); the
  head store / export / verify-heads tombstone count excludes it.
- CLI verify-chain table prints Chain from + Pre-cutoff rows.

Tests: AuditLogHashChainCutoffTests (7, MSSQL), 6 verifier unit tests,
service/CLI/management wire tests; 9 mutations all killed.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

tests/ZB.MOM.WW.ScadaBridge.CLI.Tests/Commands/AuditVerifyChainCommandTests.cs

@@ -111,6 +111,37 @@ public class AuditVerifyChainCommandTests
         Assert.Contains("--month", err);
     }
 
+    /// <summary>
+    /// ScadaBridge#139: the table report shows the chain cutoff and the pre-cutoff rows, and a
+    /// month whose backlog is out of scope still exits 0 (pre-cutoff rows are never a break).
+    /// </summary>
+    [Fact]
+    public void Render_Table_ShowsCutoffAndPreCutoffRows()
+    {
+        const string body = "{\"partition\":\"2026-11\",\"status\":\"Intact\",\"rowsVerified\":12,\"tombstonesApplied\":0," +
+            "\"purgedThroughSeq\":null,\"headSeq\":12,\"unchainedRows\":0,\"firstBreak\":null," +
+            "\"preCutoffRows\":3441,\"chainFromUtc\":\"2026-11-13T09:30:00.1234567Z\"}";
+        using var output = new StringWriter();
+
+        var exit = AuditVerifyChainHelpers.Render(body, "table", output);
+
+        Assert.Equal(0, exit);
+        Assert.Contains("Chain from        : 2026-11-13T09:30:00.1234567Z", output.ToString());
+        Assert.Contains("Pre-cutoff rows   : 3441", output.ToString());
+    }
+
+    /// <summary>A legacy (whole-table) chain renders without a cutoff.</summary>
+    [Fact]
+    public void Render_Table_NoCutoff_SaysWholeTable()
+    {
+        const string body = "{\"partition\":\"2026-05\",\"status\":\"Intact\",\"rowsVerified\":1,\"unchainedRows\":0}";
+        using var output = new StringWriter();
+
+        Assert.Equal(0, AuditVerifyChainHelpers.Render(body, "table", output));
+        Assert.Contains("Chain from        : - (whole table in scope)", output.ToString());
+        Assert.Contains("Pre-cutoff rows   : 0", output.ToString());
+    }
+
     /// <summary>Verifies that month validation accepts only values in <c>yyyy-MM</c> format.</summary>
     /// <param name="month">The month string to validate.</param>
     /// <param name="expected">Whether the month is expected to be valid.</param>